[UPHPU] PHP Vulnerability
David Smith
DavidSmith at byu.net
Fri Dec 17 14:34:28 MST 2004
I'm sure many of you saw this today:
http://developers.slashdot.org/article.pl?sid=04/12/17/1641212&tid=169&tid=172
If upgrading to PHP5 is not an option, what the heck am I supposed to do
about this? I maintain a web app that has to work in a multiplicity of
different environments, not just Apache/Linux/PHP4. Is there something I
can do in my php code to prevent this exploit? In one case, I am using
unserialize() to unserialize data directly from a POST. I could probably
rewrite the code to not use the POST data, but what option do I have if
that is not possible? Anyone?
--Dave
More information about the UPHPU
mailing list